TL;DR: What happened to the Claude Code extension on Cursor, and what should founders do?
On 29 October 2026, between about 2:27am and 1:35pm Pacific time, tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were served from Cursor's own extension marketplace for macOS and Windows. They added an attacker's SSH key labelled svc-telemetry, sent host details to the attacker and installed scripts that try to open a hidden tunnel back to the attacker. Cursor says at most 5,000 users were affected. Anthropic says its own systems and channels were not compromised. If you use Claude Code inside Cursor, search your SSH keys for svc-telemetry today. Uninstalling the extension is not enough.
A lot of solo founders I know build their product with exactly this stack: Cursor as the editor, Claude Code as the agent inside it, auto-updates on. You don't think about the extension. It just updates itself overnight and keeps working. A week later a second Claude Code risk turned up, this time with no attacker involved: Claude Code's "don't ask again" option saved passwords and API keys in files that ended up on public GitHub.
On 29 October, that habit became the attack. For about 11 hours, the update you got from Cursor's marketplace was a fake built by someone else. Here's what it did, who is affected, how to check your laptop in one minute, and what this means if you run a business in Europe.
What happened
In a security notice dated 29 October, Cursor said that between about 2:27am and 1:35pm Pacific time that day, "a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace." That's 10:27 to 21:35 in Central European Time. The affected builds were Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS. Cursor was clear about one thing: "These malicious versions of the extension were not developed by Anthropic."
Cursor removed the version, then shut down the whole marketplace, audited access, rotated its keys and rebuilt it. It says no other extensions were tampered with, and that it worked with the cloud provider to take the attacker's server offline. On 30 October it updated its notice with new indicators and added 2.1.312 to the list of affected versions.
Cursor told The Hacker News the incident was "impacting at most 5,000 users" and that it will contact affected users directly. The same report says the update "was distributed under the extension's legitimate publisher identity", and that the exact method the attacker used to get it there "remains unclear".
Anthropic's Felix Rieseberg wrote on Hacker News that "it wasn't a compromise of Anthropic's systems or employee laptops." In his words, "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension", and "this only impacts Cursor users." Microsoft confirmed that the bad packages never appeared on the Visual Studio Marketplace or in the npm package @anthropic-ai/claude-code. The clean version is now 2.1.314.
What the malware did
The security firm Phorion first flagged the package. The code ran as soon as the extension loaded, so you didn't have to open a chat or click anything. According to Cursor's notice, it did four things:
- Reported on your machine. It sent the attacker your hostname, username, operating system, home folder, working folders, Git email, public IP address and the names (not the values) of your environment variables.
- Planted a key. It added the attacker's public key, labelled svc-telemetry, to your SSH authorized_keys file.
- Tried to open a door. It tried to turn on the computer's SSH service and open a reverse SSH tunnel to the attacker's server.
- Tried to stay. It installed a LaunchAgent on macOS and a scheduled task called SysMon, with a Startup-folder fallback, on Windows. These scripts retry the tunnel about every 60 seconds.
There's some good news. Turning on SSH needs admin rights, and the malicious code had errors. Cursor says that on most macOS and Windows machines this step failed, "and the attacker could not have logged in through the tunnel." But the key, the persistence scripts and the host report still landed. Cursor also warns: "Uninstalling the extension may not be sufficient", because the scripts keep running on their own.
Sources: Cursor security notice, Microsoft Security blog, The Hacker News, Anthropic's statement on Hacker News, read 1 November 2026.
How to check your machine in one minute
Cursor's check is simple. On macOS, open Terminal and run:
On Windows, search the files %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the word svc-telemetry. Cursor's notice has a ready-made PowerShell line for it. If the key is there, your machine is affected. Cursor publishes cleanup scripts for both systems that remove the extension, the persistence, the tunnel processes and the key.
Then rotate. Cursor says to rotate "credentials and sessions accessible from affected hosts, from a trusted system", and adds that the limited collection of environment variable names "does not rule out later credential access over the backdoor." For a small team, that usually means GitHub tokens, cloud keys, AI API keys, database passwords and any admin sessions that were open on that laptop. Microsoft's analysis of the attack adds one step many founders skip: keep evidence before you wipe things, so you can answer questions later.
Why this one matters more than most
This wasn't a fake extension with a lookalike name. It came through the marketplace built into the editor, under the real publisher name, as a normal update. As Jenn Gile of OpenSourceMalware told The Hacker News, "anyone who has their Claude Code instance set to auto-update could have consumed the malware."
It's also not the first attack on AI developer tooling this month. On 21 October, the Railway breach and the poisoned LiteLLM release exposed environment variables and AI API keys. Before that, OpenCode's breach sent founders rotating their OpenAI and Anthropic keys. The pattern is clear: attackers go where developers keep their keys, and AI coding tools sit right next to all of them. Our Claude Code news for October 2026 and cybersecurity news for October 2026 track the rest of the month.
Microsoft's advice to companies using Cursor is worth copying even if you're a team of one: allow extensions only from approved publishers, and set an installation cooldown so new versions wait a while before they reach your machine. Most poisoned updates are caught within hours. A one-day delay would have skipped this one entirely.
The Europe angle: GDPR and the Cyber Resilience Act
If you're a European founder and the svc-telemetry key turns up on a laptop that could reach customer data, treat it as a possible personal data breach. Under Article 33 of the GDPR (Adopted, in force), a controller must notify its supervisory authority "without undue delay and, where feasible, not later than 72 hours" after becoming aware of a breach, "unless the personal data breach is unlikely to result in a risk" to people. If the tunnel failed and no customer data was reachable, you may conclude there's no risk, but write that decision down with your reasons.
There's also a newer rule in the background. Since 11 September 2026, the EU's Cyber Resilience Act reporting obligations (Adopted, in application) require manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours and a full notification within 72 hours. Whether this incident triggers a CRA report for Cursor or anyone else hasn't been made public. If you sell software in the EU, though, this is your reminder that a 72-hour clock now applies to you too. The Belgian Vanden Broele cyberattack showed what the first 72 hours look like in practice.
Sources: GDPR Article 33 text; European Commission CRA reporting page, read 1 November 2026. This is general information, not legal advice.
What this means for you
- Run the check today. If you used Claude Code in Cursor on 29 October, search for svc-telemetry on every laptop, including your freelancers'. It takes a minute.
- If you find it, clean first, then rotate. Use Cursor's script, then change every key and session the laptop could reach from a different, clean device. Keep a short log of what you did and when.
- Turn off blind auto-updates for extensions. Use a cooldown and an approved-publisher list where your editor allows it. Our guide to building security into startup operations from day one covers the basic setup.
- Shrink what a stolen laptop can reach. Use short-lived tokens, separate keys per project, and no production database passwords in local environment files.
- Decide on GDPR in writing. If customer data was reachable, assess the risk and the 72-hour deadline. Our GDPR compliance checklist for early-stage startups helps you set up a breach log before you need one.
- Know your tool stack. List every editor extension and AI agent with access to your code and keys, and where each one comes from. Keep it next to your essential startup tool stack so it stays up to date.
My take: nobody here did anything stupid. Founders trusted an official extension, from an official marketplace, under the official publisher name. That's exactly why it worked. The lesson isn't "stop using AI coding tools". It's that your editor is now part of your attack surface, and it deserves the same care as your production server.
Are you getting customers from AI search yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
FAQ: the Claude Code extension backdoor on Cursor
Which Claude Code versions were malicious?
Versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for macOS and Windows, served from Cursor's VS Code Extension Marketplace between about 2:27am and 1:35pm Pacific time on 29 October 2026. The clean version is 2.1.314.
Was Anthropic hacked?
Anthropic says no. Its Felix Rieseberg wrote that it "wasn't a compromise of Anthropic's systems or employee laptops" and that a malicious actor used access to Cursor's marketplace. Microsoft and Cursor also say Anthropic did not build the tampered versions. How the attacker got publishing access hasn't been explained yet.
I use Claude Code in VS Code, not Cursor. Am I affected?
Based on what Microsoft and Anthropic have published, no. The bad packages were never on Microsoft's Visual Studio Marketplace or in the npm package @anthropic-ai/claude-code, and Anthropic says only Cursor users are affected.
How do I know if my computer is infected?
Search your SSH authorized_keys files for the word svc-telemetry. On macOS that's ~/.ssh/authorized_keys; on Windows, %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. If the key is there, your machine is affected and you should follow Cursor's cleanup steps.
Is uninstalling the extension enough?
No. Cursor warns that uninstalling may not be sufficient, because the malware installs standalone persistence scripts. Use Cursor's remediation script for your system, then rotate credentials and sessions from a clean device.
Do I have to report this under GDPR?
Only if it led to a personal data breach that is likely to result in a risk to people. Then GDPR Article 33 asks you to notify your supervisory authority within 72 hours where feasible. If the laptop couldn't reach personal data, or the tunnel failed, document why you decided not to report.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
